1
0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Files
ffmpeg/libavfilter
Zhao Zhili 5a1dc812b1 avfilter/vf_ssim360: fix integer overflow in tape_length allocation
tape_length * 8 overflows 32-bit int for large input widths. Then
av_malloc_array() allocates a tiny buffer while the subsequent
loop writes tape_length*8 BilinearMap entries, causing
heap-buffer-overflow.

Validate the value in float before converting to int and left
shifting, to avoid both float-to-int and signed left shift
overflow UB. Also split av_malloc_array() arguments to avoid
the multiplication overflow.

Fixes: #21511

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit b62ae766c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-05-03 19:24:52 +02:00
..
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-08-19 21:48:04 +02:00
2024-08-19 21:48:04 +02:00
2024-08-19 21:48:04 +02:00
…
…
…
…
…
2024-08-19 21:48:04 +02:00
2025-12-14 12:41:00 +05:30
…
…
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
…
…
2024-08-19 21:48:04 +02:00
…
…
…
2024-08-19 21:48:04 +02:00
…
…
2025-08-03 13:48:47 +02:00
2024-07-01 22:31:02 +02:00
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-08-19 21:48:04 +02:00
…
2024-02-16 21:34:38 +01:00
2026-03-08 02:29:20 +01:00
2025-06-15 21:00:38 +05:30
2025-10-16 18:41:19 +02:00
2025-07-04 01:32:27 +02:00
2025-07-04 01:32:27 +02:00
…
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
…
2025-08-03 13:48:47 +02:00
2025-04-22 20:45:57 +02:00
…
…